How to Tell a Real ChatGPT or Claude App From a Credential-Stealing Fake

Security vendors documented fake ChatGPT and Claude installers, ads and invitation emails throughout 2026, some running the real app while malware works in the background. Appearance is an unreliable test, and the most dependable habit is checking provenance: how you reached the page, not how it looks.

Telling a genuine ChatGPT or Claude app from a credential-stealing fake is harder than checking for typos or a padlock. Security researchers documented campaigns in 2026 in which the fake installer launched a working copy of the real app while malware ran quietly behind it, and others in which the malicious page sat on a legitimate domain. The signal that held up across reports is provenance: how a person arrived at the download, not what the page looked like.

The question gained attention after the security vendor ANY.RUN said it had linked 1,258 public sandbox analyses to fake-AI campaigns between April 15 and October 5, 2026, with the United States the second-largest source of submissions. That number says something real about attacker interest, but less than the headlines suggest. It is a count of files and links that people uploaded to one company's analysis service, not of victims.

What the 1,258 figure counts, and what it does not

According to ANY.RUN's own blog, the 1,258 analyses were public sandbox submissions tied to fake-AI campaigns, and the company reported more than 100 such analyses in every month from April through September. Trade outlet Cyber Security News, relaying the vendor's findings, reported that the US accounted for 16% of submissions that carried country information, second to India at 20%. The same coverage said US submissions led in two campaign groups: fake Claude downloads and ChatGPT-themed attacks.

The limits are stated by the sources themselves. SafetyBis, in a piece it says was written with ANY.RUN, describes the figures as submissions rather than confirmed victims. Softtechhub notes that the count covers uploads to ANY.RUN's own service, and that ANY.RUN sells a sandbox product, so the research also promotes that product. A submission could just as easily come from an analyst testing a suspicious link as from someone who was infected, and the US share may partly reflect where the vendor's users are located.

One further caution applies to reading the numbers. ANY.RUN's definition of “fake AI” and the way it grouped campaigns were not visible in the material reviewed, so the dataset cannot show how common fake AI apps are compared with other threats. Its main value is descriptive: it records the techniques that showed up repeatedly.

What the documented fakes look like

Lookalike download pages and paid ads

Malwarebytes Labs reported on May 28, 2026 that a site at openew[.]app closely imitated OpenAI's real ChatGPT download experience. Windows visitors received a credential-stealing loader, while Mac visitors received Odyssey Stealer, a fork of Atomic Stealer. Trade outlet VARINDIA added that the Windows payload was assembled from free tools and that the macOS stealer is rented for roughly $3,000 a month, paid in cryptocurrency.

Claude has drawn similar campaigns. In April 2026, Malwarebytes described a fake site that mimicked Claude's official page and delivered a ZIP file. The package installed a functioning copy of Claude and, in the background, a PlugX malware chain that gives attackers remote access. Straiker described the file as a 508 MB MSI installer. Max Gannon of Cofense told ITPro that installing a working copy of the app is what makes the attack unusual, since it is rather large.

Trend Micro tracked a technique it calls InstallFix, in which people searching for Claude Code land on fake installation pages promoted through Google Ads. Cyber Security News reported that a search for “Claude Code” or “Claude Code install” returned a sponsored link first, and that the page used ClickFix: it presented an operating-system-specific command as a required installation step. Straiker reported that fake install pages have been confirmed for Claude Code (30+ domains), NotebookLM, JetBrains PyCharm, AtlasGPT, Cline, Comet and Snowflake, so the pattern extends well beyond one brand.

Malicious content on genuine domains

TechRepublic, citing BleepingComputer, described a campaign that combined Google Ads with Claude shared chats. The ads appeared to point to Anthropic's real domain, but the shared chats contained fake setup instructions that could install malware. BleepingComputer, reporting findings from Huntress, separately described a Bing malvertising campaign that pushed a fake Claude desktop installer hosted on a legitimate Claude.ai domain and delivered SectopRAT. At least 29 organizations were compromised on July 21–22, and Huntress found that the malicious Claude Artifact had been downloaded 7,100 times before Anthropic removed it.

In September, Cyber Security News relayed a SEQRITE report on fake Claude and ChatGPT installers and sponsored search results that pushed MacSync, a macOS password stealer sold as malware-as-a-service. SEQRITE said it can also establish lasting access to an infected machine. A secondary blog claims a ChatGPT outage page on ChatGPT's real domain redirected visitors to a malware site in an “LLMShare” campaign, but that account rests on one weak source and Push Security's own report was not found.

Invitations and fake sign-in portals

The best-documented invitation-style lure targets advertisers. Cyber Security News, relaying research from Island.io's Oleg Zaytsev and Ofek Ronen, reported fake AI advertising products impersonating ChatGPT, Claude and Gemini. Invitation emails lead advertisers to the pages. The researchers observed hundreds of victim submissions, and activity was continuing when the findings were published on October 6, 2026.

The reported mechanics show why these portals are hard to catch. Attackers could reject a password, choose which authentication challenge to present and redirect the victim afterward. Three separate password attempts were preserved, so an operator could claim an entry failed while keeping every value typed. Island's original report was not retrieved, so these details rest on the trade-press account.

The phrase “fake applications and event invitations impersonating ChatGPT, Claude, and other popular services” appears in The Hacker News coverage of ANY.RUN's findings, but it is a summary. No primary description of fake AI-event invitations specifically was found, so the advertiser-invitation campaign is the clearest evidence for this lure type. A related ANY.RUN cluster, SkyW4lker, is device-code phishing: according to SafetyBis, such campaigns abuse Microsoft's legitimate device-code sign-in so victims complete real multifactor authentication while attackers receive the resulting tokens. ANY.RUN counted 618 related analyses from June to October 21, 2026, 46% from the US, rising from 20 a month in June to 200 in September.

Why looking at the page is an unreliable test

The usual advice is to inspect the page for flaws. The documented campaigns defeat several standard tells, and the reasons are specific.

• The real app can run. In the Claude PlugX case and in some cases ANY.RUN observed, the installer launched a genuine application while stealing browser sessions or deploying malware out of sight. A working app proves nothing.
• The address can be genuine. Malicious Claude Artifacts, shared chats and, reportedly, an outage page all sat on real domains. Checking the address bar alone is insufficient.
• A padlock is not proof. A consumer-security blog noted that the fake ChatGPT site displayed one because the .app top-level domain requires HTTPS. That is a single weak source, but the point matches the logic of the case.
• Typos disappear. The install path in the Claude case contained “Cluade,” which Malwarebytes called a clear red flag, but it was visible only after installation, and attackers can correct such errors. CISA lists misspellings as a general phishing sign, yet these campaigns were polished.
• A terminal command is not automatically a warning sign. Developer tools such as Claude Code do have terminal installers, so a fake instruction may not look unusual. Straiker's analysis shows attackers mixing a real claude.ai install script address with attacker-controlled GitHub scripts. What matters is where the command came from.
• Ordinary MFA can be bypassed. In device-code and adversary-in-the-middle schemes, the victim completes real authentication. CISA's Black Basta advisory recommends phishing-resistant MFA for organizations.

Real software can also look wrong, which complicates the opposite instinct. OpenAI's help center documents a new ChatGPT desktop app, with Chat and Work under ChatGPT alongside Codex on macOS and Windows, that may install alongside the current app. The previous version is renamed ChatGPT Classic and keeps working, so two ChatGPT apps on one computer is not by itself a sign of a fake.

A blog citing Moonlock reported that in May 2026 macOS moved the genuine ChatGPT app to the Trash as malware for some users who had not updated, because OpenAI had rotated its certificate; updating fixed it. That account comes from one secondary source, but it illustrates that a security warning can also be a false alarm.

What holds up: provenance over appearance

Across the reports, the attack chains mostly begin the same way: a sponsored ad, a search result, a shared link or an unsolicited email. Features that recurred in documented fakes make a more reliable screen than visual polish. This list is a synthesis of the cited reports, not an official checklist, and none of the sources gives a validated rule or a detection rate.

• The visitor arrived through a sponsored ad or search result instead of typing the official address or using an app store.
• The page asks for a command to be pasted into Terminal or PowerShell, or to “verify you're human” by running something.
• The offer is a free “Pro,” “Opus” or “Max” tier or a special build.
• An unsolicited invitation leads to a sign-in pop-up, a reject-and-retry password loop, or a device code that was never requested.
• The publisher or developer name does not match the official one listed in the app store.

Where genuine apps come from

OpenAI's help center says the ChatGPT macOS download is at chatgpt.com/download, and tells existing desktop users to follow the prompt inside the app to move to the new version. For Claude, TechRepublic advised Mac users to go straight to Anthropic's official site or type claude.ai into the browser. An explainx FAQ, a weak source, adds claude.ai/download and the official app stores, and says to use apps listed under Anthropic's developer account.

No Anthropic-published page on official download locations was retrieved, so the official installation command for developer tools is not stated here. That gap matters because the decisive question for any command is its source.

What US government guidance adds

CISA lists urgent or emotional language, requests for personal or financial information, untrusted shortened URLs, and incorrect email addresses or links as signs of phishing. Its guidance for businesses adds hovering over a link to see where it leads and looking up a sender's phone number to make contact directly. The FTC advises against clicking links in unexpected emails or texts and recommends contacting a company through a link or number already known to be genuine. None of this guidance addresses AI brands specifically, but it matches the provenance logic that the vendor reports point to.

If something may have gone wrong

Official remediation guidance for fake installers specifically was not retrieved, so the steps below come from generic phishing advice. The FTC says that anyone who gave out a Social Security, card or bank number should report it at IdentityTheft.gov, and that someone who clicked an unexpected link should update security software and run a scan. CISA's business guidance says to change passwords if phishing is suspected and to report and delete the message. The FTC takes scam reports at ReportFraud.ftc.gov.

Several reported campaigns stole browser sessions, and one gave the attacker lasting access, so generic steps may not cover every case. Malwarebytes has a section on what to do after a possible installation that was not reviewed here. This article offers researched context rather than personal security advice.

What it means, and what to watch

The campaigns share a business model more than a look. Attackers bet on the moment someone searches for a popular AI tool or receives a plausible invitation, then borrow trust from an ad slot, a shared-chat feature or a familiar login window. As AI brands become everyday names, that moment arrives for more people, including employees who install tools without involving an IT department.

The reliable lesson from 2026's reports is modest and practical: go to the source yourself, treat a pasted command as something that needs a verified origin, and treat any sign-in prompt that arrives uninvited as unproven. What remains unsettled is how many people are actually harmed, how well platforms are closing the abuse, and whether habits like these measurably reduce infections. Those answers will need law-enforcement data, platform disclosures or independent telemetry rather than vendor sample counts.

Frequently asked questions

Does the 1,258 figure mean 1,258 US companies were attacked?

No. ANY.RUN counted public sandbox analyses linked to fake-AI campaigns between April 15 and October 5, 2026. The sources describe them as submissions, not confirmed victims, and the US share was 16% of those with country information, second to India at 20%. One vendor page was headed with “US Companies,” but its own text says analyses.

Is a padlock or HTTPS enough to show an AI website is real?

Not according to the reports reviewed. A consumer-security blog noted that the fake ChatGPT download site displayed a padlock because the .app domain requires HTTPS. Malicious content has also been documented on genuine Claude domains, so the address bar alone is insufficient.

Where do the official ChatGPT and Claude downloads come from?

OpenAI's help center lists chatgpt.com/download for the macOS app, and says existing users should follow the in-app prompt to reach the new desktop app. TechRepublic advised Mac users wanting Claude to go to Anthropic's official site or type claude.ai into the browser. An Anthropic-published page on official downloads was not retrieved.

Is an installer that asks me to run a terminal command always a scam?

No. Developer tools such as Claude Code do have terminal installers. In documented fakes, the command came from an ad-driven page or a shared chat, and Straiker found attackers mixing a real script address with attacker-controlled ones. The source of the command is the deciding factor.

What should someone do after installing a suspicious AI app?

The FTC advises updating security software and running a scan after clicking an unexpected link, reporting any shared Social Security, card or bank numbers at IdentityTheft.gov, and reporting scams at ReportFraud.ftc.gov. CISA's business guidance adds changing passwords if phishing is suspected. These are generic steps, not instructions specific to fake AI installers.

Sources

1. Fake AI Tools Target US Companies: Claude, ChatGPT & Copilot , ANY.RUN
2. Major Cyber Attacks in October 2026: Fake AI Targets US and EU , ANY.RUN
3. The AI Adoption Blind Spot: How Fake AI Tools Put Enterprises at Risk , Cyber Security News
4. Fake AI Attacks Spread Across US Companies: How MSSPs Can Stop Incidents Early , The Hacker News
5. 5 Active Cyber Threats That Put US Enterprises at Risk in October 2026 , The Hacker News
6. Microsoft device code phishing: October 2026 checks , SafetyBis
7. Fake AI Tools: 6 Powerful Lessons From 1,258 Attack Sessions , Softtechhub (2026-10-28)
8. Fake ChatGPT download site infects Windows and Mac users with malware , Malwarebytes Labs (2026-05-28)
9. Fake ChatGPT Site Spreads Malware on Windows and Mac , VARINDIA (2026-06-02)
10. The ChatGPT Download Scam That Works Even When You Do Everything Right , AllAboutCookies (2026-06-24)
11. Fake Claude site installs malware that gives attackers access to your computer , Malwarebytes (2026-04-01)
12. Claude users beware, hackers are using a fake website to dupe developers and deliver malware , ITPro
13. Fake Claude Code, Real Malware , Straiker
14. InstallFix and Claude Code: How Fake Install Pages Lead to Real Compromise , Trend Micro
15. Hackers Using Fake Claude AI Installer Pages to Trick Users Into Running Malware on Their Systems , Cyber Security News
16. Mac Users Warned Over Fake Claude Install Instructions , TechRepublic
17. Fake Claude app promoted by Bing ads pushes SectopRAT malware , BleepingComputer
18. Hackers Use Fake Claude and ChatGPT Installers to Infect Mac Users With Password-Stealing Malware , Cyber Security News (2026-09-10)
19. Hackers Use Fake ChatGPT, Claude and Gemini Ads to Steal Passwords and MFA Codes , Cyber Security News (2026-10-07)
20. Is ChatGPT Safe? The Real Risks in 2026, Explained , Fello AI
21. Fake Claude App RevStealer Malware: How to Spot It (2026) , explainx.ai
22. Downloading the ChatGPT macOS app , OpenAI Help Center
23. Moving to the new ChatGPT desktop app , OpenAI Help Center
24. Recognize and Report Phishing , CISA
25. Teach Employees to Avoid Phishing , CISA
26. #StopRansomware: Black Basta , CISA
27. Don't take the bait on phishing scams , Federal Trade Commission (2024-09-01)
28. How To Avoid a Scam , Federal Trade Commission